Privacy Policy

The purpose of this Privacy Policy is to define the principles of data processing within the framework of the activities carried out by the Administrator, in particular in connection with the use of the website, hereinafter referred to as the Website.
This Privacy Policy applies in all cases in which the Controller processes personal data of natural persons.
Based in particular on the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the GDPR, the Administrator takes all necessary security measures to protect the personal data being processed.
Personal data refers to any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
The controller of your personal data is the Medical University of Lodz, 90–419 Lodz, Al. Kościuszki 4, hereinafter referred to as the Controller. The Controller has appointed a Data Protection Officer (DPO) who oversees the correct processing of your data. You can contact the DPO electronically at: iod@umed.lodz.pl
The Administrator processes personal data using appropriate security measures that meet the requirements of Polish law, in particular in accordance with the GDPR.
The Administrator obtains information about users and their behavior in the following manner:
1. through information entered voluntarily in forms,
2. by saving cookie files (so-called “cookies”) in end devices.
The website collects information provided voluntarily by the user.
The Controller processes data lawfully, fairly, and transparently for the data subject. The Controller’s processing of personal data lawfully means that the Controller processes personal data only when it has a clear legal basis for doing so, arising directly from the GDPR or other generally applicable EU or national laws.
The Administrator collects data for specific, explicit, and legitimate purposes and does not further process it in a manner incompatible with those purposes. If the Administrator is deprived of the purpose of processing, the Administrator immediately permanently deletes the data, unless the right to further processing arises from generally applicable law. The Administrator periodically assesses the legitimacy of processing specific personal data, taking into account the relevance of the processing purposes.
The Administrator processes data in a manner that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. The Administrator strives to continually minimize the amount of personal data processed. To this end, the Administrator periodically assesses the scope and types of personal data being processed to determine the necessity of processing or the possibility of permanently deleting it.
The Administrator ensures that the data processed by him are correct and, where necessary and possible, updates them.
The Data Controller stores data in a form that permits the identification of the data subject for no longer than is necessary for the purposes for which the data is processed, taking into account applicable legal provisions permitting the Data Controller to process personal data for a specified period, in particular the period for which medical records and personal files are stored, the period for pursuing rights, and the limitation period for claims. If the storage period for certain personal data expires, the Data Controller is generally obligated to immediately permanently delete the personal data in question, unless separate legal provisions require the Data Controller to archive documentation containing personal data.
The Administrator processes personal data in order to respond to messages sent to the Administrator via the Website based on the voluntary consent of the Website user (Article 6, paragraph 1, point a of the GDPR) and for analytical research, consisting in particular in the study and analysis of traffic on the above-mentioned website and the collection of statistical data.
Users’ personal data will be stored by the Administrator until the message is responded to or until consent is withdrawn, whichever comes first.
The Administrator does not process data in an automated manner and does not use it for profiling purposes.
The Administrator does not transfer personal data outside the European Economic Area (including the European Union, Norway, Liechtenstein and Iceland).
Every data subject has the right to:
1. Access to data – obtaining confirmation from the Controller as to whether their personal data are being processed. If data about a person is being processed, they are entitled to access it and obtain the following information: the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the data have been or will be disclosed, the data storage period or the criteria for determining them, the right to request rectification, erasure, or restriction of processing of personal data of the data subject, and to object to such processing (Article 15 of the GDPR);
2. receiving a copy of the data – obtaining a copy of the data subject to processing, the first copy being free of charge, and for subsequent copies the Controller may impose a reasonable fee resulting from administrative costs (Article 15, paragraph 3 of the GDPR);
3. rectification – requesting the rectification of personal data concerning you that is incorrect or the completion of incomplete data (Article 16 of the GDPR);
4. deletion of data – request the deletion of your personal data if the Controller no longer has a legal basis for processing them or the data are no longer necessary for the purposes of processing (Article 17 of the GDPR);
5. restriction of processing – request to limit the processing of personal data (Article 18 of the GDPR) when:
  1. the data subject questions the accuracy of the personal data – for a period enabling the Controller to check the accuracy of such data,
  2. the processing is unlawful and the data subject opposes their deletion, requesting the restriction of their use,
  3. The controller no longer needs this data, but the data subject needs it to establish, pursue or defend legal claims,
  4. the data subject has objected to the processing – until it is determined whether the legitimate grounds on the part of the Controller override the grounds for objection of the data subject;
6. data portability – to receive personal data concerning him/her, which he/she provided to the Controller, in a structured, commonly used and machine-readable format, and to request that such data be transmitted to another Controller, if the data are processed on the basis of the data subject’s consent or a contract concluded with him/her and if the data are processed by automated means (Article 20 of the GDPR);
7. Objection – object to the processing of their personal data for the Controller’s legitimate purposes, for reasons related to their particular situation, including profiling. The Controller assesses the existence of compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subjects, or grounds for establishing, pursuing, or defending legal claims. If, according to the assessment, the interests of the data subject outweigh the Controller’s interests, the Controller will be obliged to cease processing the data for these purposes (Article 21 of the GDPR);
8. Withdraw consent at any time and without providing a reason, but the processing of personal data carried out prior to withdrawal will continue to be lawful. Withdrawal of consent will result in the Controller ceasing to process personal data for the purpose for which consent was given – this applies only to cases in which consent constitutes the legal basis for processing.
Providing personal data is completely voluntary.
The data subject has the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office, based in Warsaw. Complaints can be submitted in the following forms:
1. in writing to the following address: ul. Stawki 2, 00–193 Warsaw,
2. electronically: via the ePUAP platform.
The website uses cookies, which are small text files sent by a web server and stored on the user’s end (usually on the hard drive). They typically contain the name of the website they originated from, the duration of their storage on the end device, and a unique number. Default cookie parameters allow only the server that created them to read the information they contain. These files allow the user’s device to be recognized and the website to be displayed appropriately, tailored to their individual preferences.

TYPES OF COOKIES

Two types of cookies are used:

SESSION – temporary files that remain on the user’s device until logging out of the website or turning off the software (web browser).

PERMANENT – files remain on the user’s device for the time specified in the cookie parameters or until they are manually deleted by the user.

Cookies used by the website operator’s partners, including in particular website users, are subject to their own privacy policies.

COOKIES AND PERSONAL DATA

Personal data collected using cookies may only be collected to perform specific functions for the user. Such data is encrypted to prevent unauthorized access.

DELETING COOKIES

By default, web browsing software allows cookies to be placed on end devices. These settings can be changed to block automatic cookie handling in the web browser settings or to notify the user each time they are sent to the device. Detailed information about the possibilities and methods for managing cookies is available in the software (web browser) settings.

Restricting the use of cookies may affect some of the functionalities available on the website.

Chrome

At the top of the Chrome browser window, click “Chrome Menu” – the three-line icon on the browser toolbar.
Select “Settings”.
Click “Show advanced settings.”
In the “Privacy” section, click the “Content Settings” button.
In the “Cookies” section, click “All cookies and site data” to open the “Cookies and other data” dialog box.
Depending on your decision, select “Allow local data to be set”, “Block websites from setting data on your computer”, “Ignore exceptions and block the setting of third-party cookies” or “Delete”.

Firefox

At the top of the Firefox window, click the “Firefox” button (in XP, click the “Tools” menu) and select “Options.”
In the “Privacy” tab, select “will use user history settings.”
Depending on your decision, select “I accept cookies”.

Internet Explorer

At the top of the browser window, select “Tools,” then click “Internet Options.”
In the “Privacy” tab, in the “Advanced” tab, select how you want to handle cookies.

Opera

At the top of the browser window, go to “Settings”, then “Preferences” and select “Advanced”.
Select the “Cookies” section.
Depending on your decision, select “Accept cookies”, “Accept cookies only from the website I visit”, “Delete new cookies when closing Opera”, “Manage cookies”.